CVE-2019-0604

What is Microsoft SharePoint?

SharePoint is Microsoft's on-premises and hybrid collaboration platform, used by governments, enterprises, and universities worldwide to host intranets, document libraries, and workflow applications. Because it typically sits at the center of an organization's internal document ecosystem — often internet-facing for remote access — a remote code execution flaw in SharePoint gives an attacker a foothold deep inside the network with access to sensitive internal documents and a base from which to pivot further.

Overview

CVE-2019-0604 is a critical unauthenticated remote code execution vulnerability in Microsoft SharePoint caused by improper validation of input (CWE-20): the server fails to properly check the source markup of an uploaded SharePoint application package. An attacker can upload a specially crafted package to a vulnerable SharePoint site and have it execute code in the context of the SharePoint application pool and server farm account — with no authentication required in the vulnerable configuration. Rated Critical (9.8), it was fixed in Microsoft's February 2019 Patch Tuesday and became one of the most actively exploited SharePoint bugs of 2019, with multiple follow-on advisories issued as attackers continued targeting unpatched instances well into 2019 and 2020.

Affected Versions

Refer to the vendor advisory linked from NVD for the exact KB numbers applicable to each SharePoint edition and language pack.

Technical Details

The vulnerability arises because SharePoint's application package deployment process does not adequately validate the contents of an uploaded .wsp/.app package before processing it, allowing embedded code to run server-side. Because deployment of application packages is a legitimate SharePoint feature, the flaw let a remote, unauthenticated attacker (in many observed deployments) or a low-privileged authenticated user reach code execution with a single crafted upload — no complex exploit chain or user interaction was required, making it an efficient target for mass scanning.

Discovery

Fixed through Microsoft's routine February 2019 Patch Tuesday release; no single external researcher has been broadly credited for the initial report. However, widespread real-world exploitation was documented by multiple security researchers and national CERTs in the months after disclosure, once public proof-of-concept exploit code began circulating.

Exploitation Context

CVE-2019-0604 saw substantial real-world exploitation throughout 2019. Security researchers and government CERTs reported nation-state and financially motivated actors scanning for and compromising internet-facing SharePoint servers — particularly government and telecom targets in the Middle East and Asia — frequently dropping the China Chopper webshell to maintain persistent access after exploitation. CISA's KEV entry additionally notes the flaw has been leveraged in ransomware intrusions, and it remains a common target for opportunistic scanning against unpatched legacy SharePoint farms years after the patch was released.

Remediation

1. Apply the February 2019 SharePoint security update (or any later cumulative update) for your specific SharePoint edition immediately.
2. Scan SharePoint web front-end servers for known webshells (China Chopper and similar) and unexpected .aspx files in web-accessible directories.
3. Review IIS and SharePoint ULS logs for anomalous application-package uploads or POST requests to deployment endpoints predating patching.
4. Restrict direct internet exposure of SharePoint farms where possible, placing them behind a VPN or authenticated reverse proxy.
5. Rotate credentials and audit for persistence (scheduled tasks, new service accounts, additional webshells) on any server confirmed to have been unpatched during the exploitation window.